modelrig 0.6.0 → 0.8.0

package/dist/run/dispatch.js

@@ -16,11 +16,13 @@ exports.jsonModeCoaching = jsonModeCoaching;
 exports.buildAdapterRequest = buildAdapterRequest;
 exports.buildRepairAdapterRequest = buildRepairAdapterRequest;
 exports.dispatchCandidate = dispatchCandidate;
+exports.buildDispatchMaybeMasked = buildDispatchMaybeMasked;
 exports.emitToolCallResult = emitToolCallResult;
 const node_crypto_1 = require("node:crypto");
 const attempt_meta_1 = require("../telemetry/attempt-meta");
 const cache_stamp_1 = require("./cache-stamp");
 const cache_handle_1 = require("./cache-handle");
+const seam_1 = require("../mask/seam");
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
  * and the output text (hashed). One helper so the routed lane's several record
@@ -179,6 +181,37 @@ async function dispatchCandidate(adapter, req, onDelta) {
         },
     });
 }
+/**
+ * Build the primary AdapterRequest, mask its outgoing user slot when the route
+ * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
+ * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
+ * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
+ * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
+ * content in the user path).
+ */
+async function buildDispatchMaybeMasked(adapter, parts, onDelta, mask) {
+    const built = buildAdapterRequest(parts);
+    if (mask === null) {
+        const started = Date.now();
+        const result = await dispatchCandidate(adapter, built, onDelta);
+        return { request: built, result, latencyMs: Date.now() - started, seam: null };
+    }
+    const seam = (0, seam_1.createMaskSeam)(mask.policy, mask.vault);
+    const outcome = seam.maskRequest(built);
+    if (outcome.kind !== "ok") {
+        // Fail closed: no request is sent. The run loop refuses pre-dispatch.
+        return {
+            request: built,
+            result: { ok: false, failure: { class: "invariant_violation", message: `masking failed closed (${outcome.kind})`, provider: parts.candidate.provider, model: parts.candidate.model } },
+            latencyMs: 0,
+            seam,
+            maskRefusal: outcome.kind,
+        };
+    }
+    const started = Date.now();
+    const result = await dispatchCandidate(adapter, outcome.request, onDelta);
+    return { request: outcome.request, result, latencyMs: Date.now() - started, seam };
+}
 /**
  * Record a tool-call turn and build its RunResult (spec §4.4). A tool call is
  * NOT a schema-validated JSON turn: it records a normal (non-failure) telemetry

package/dist/run/grounding.d.ts

@@ -8,7 +8,14 @@
  * The Tavily-style provider ports the PATTERN from InferWealth's production
  * websearch provider (query-length cap, basic/advanced depth, result shape)
  * — logic only, no cross-package imports; key arrives via config.
+ *
+ * Screening S1/S5 (SC-0 B3): the `grounding.assembly: spotlight` knob routes
+ * search results through the provenance assembler as an untrusted user-slot
+ * block instead of concatenating them into the system prompt (INJ-1), and
+ * `extractCitations` allowlists model-output URLs to the injected sources (INJ-6).
  */
+import type { RouteBundle } from "../types/route";
+import { type ProviderId } from "../types/provider";
 export interface SearchResultItem {
     readonly title: string;
     readonly url: string;
@@ -50,7 +57,45 @@ export interface UrlCitation {
     readonly title?: string;
 }
 /** Extract URLs cited in the model's output and normalize to url_citation
- * annotations, enriching with titles from the injected sources. Deduped,
- * trailing punctuation stripped (same normalization as the probe suite). */
+ * annotations, enriching with titles from the injected sources.
+ *
+ * Screening S5 (SC-0 B3, INJ-6): ALLOWLISTED — only URLs that appear in the
+ * injected `sources` survive; a URL the model emitted that was not among the
+ * grounded sources is dropped (counted by `countDroppedCitations`). A model can
+ * no longer smuggle an attacker-controlled link into the caller's citation set. */
 export declare function extractCitations(outputText: string, sources: readonly SearchResultItem[]): UrlCitation[];
+/** Count of model-output URLs dropped by the S5 allowlist (not in the injected
+ * sources) — rides the attempt envelope as `meta.grounding.citations_dropped`. */
+export declare function countDroppedCitations(outputText: string, sources: readonly SearchResultItem[]): number;
+/** The grounding slice of the attempt meta: allowlisted citations plus the
+ * dropped-count (S5). Built once per successful grounded attempt so `run.ts`
+ * stays at its LOC ceiling (spec §10(i) — the seam lives here, not in run.ts). */
+export declare function groundingMeta(outputText: string, sources: readonly SearchResultItem[]): {
+    citations: UrlCitation[];
+    grounding: {
+        citations_dropped: number;
+    };
+};
+/** Per-result snippet cap for the spotlighted search block (S1) — bounds the
+ * untrusted payload a single result can inject. */
+export declare const SEARCH_SNIPPET_MAX_CHARS = 500;
+/** Screening S1 (SC-0 B3): the SYSTEM-slot append for grounding.
+ * `legacy` (default) = the byte-identical pre-B3 injection block; `spotlight` =
+ * nothing (the results move to the user slot via `untrustedUserBlock`, and the
+ * untrusted-input policy sentence is owned by the provenance assembler and added
+ * to the system slot via `untrustedSystemAppend` — screening F2, single owner). */
+export declare function groundingSystemAppend(assembly: RouteBundle["groundingAssembly"], results: readonly SearchResultItem[], retrievedAt: string): string;
+/** Screening S1 + S2 (SC-0 B3): the USER-slot untrusted block appended after the
+ * user directive. Assembles the untrusted segments into a single spotlighted,
+ * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
+ * when there is nothing untrusted (byte-identical default). */
+export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, provider: ProviderId): string;
+/** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
+ * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
+ * surfaces its system-slot output whenever ANY untrusted segment is delivered —
+ * so an `x-trust: untrusted` variable that is NOT referenced in the system
+ * template still gets its "this is data" framing. Returns "" when there is
+ * nothing untrusted (byte-identical default). The assembler's system slot does
+ * not depend on the nonce or the block shape, so fixed placeholders suffice. */
+export declare function untrustedSystemAppend(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null): string;
 //# sourceMappingURL=grounding.d.ts.map

package/dist/run/grounding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;4EAE4E;AAC5E,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf"}
+{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;;;;mFAMmF;AACnF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf;AAED;kFACkF;AAClF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,MAAM,CAGR;AAED;;kFAEkF;AAClF,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC;IAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKxE;AAED;mDACmD;AACnD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAM5C;;;;mFAImF;AACnF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,EAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAiCD;;;+DAG+D;AAC/D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,QAAQ,EAAE,UAAU,GACnB,MAAM,CAKR;AAED;;;;;;gFAMgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,GAClD,MAAM,CAKR"}

package/dist/run/grounding.js

@@ -9,13 +9,26 @@
  * The Tavily-style provider ports the PATTERN from InferWealth's production
  * websearch provider (query-length cap, basic/advanced depth, result shape)
  * — logic only, no cross-package imports; key arrives via config.
+ *
+ * Screening S1/S5 (SC-0 B3): the `grounding.assembly: spotlight` knob routes
+ * search results through the provenance assembler as an untrusted user-slot
+ * block instead of concatenating them into the system prompt (INJ-1), and
+ * `extractCitations` allowlists model-output URLs to the injected sources (INJ-6).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SEARCH_QUERY_MAX_CHARS = void 0;
+exports.SEARCH_SNIPPET_MAX_CHARS = exports.SEARCH_QUERY_MAX_CHARS = void 0;
 exports.capSearchQuery = capSearchQuery;
 exports.createTavilySearchProvider = createTavilySearchProvider;
 exports.searchInjectionBlock = searchInjectionBlock;
 exports.extractCitations = extractCitations;
+exports.countDroppedCitations = countDroppedCitations;
+exports.groundingMeta = groundingMeta;
+exports.groundingSystemAppend = groundingSystemAppend;
+exports.untrustedUserBlock = untrustedUserBlock;
+exports.untrustedSystemAppend = untrustedSystemAppend;
+const node_crypto_1 = require("node:crypto");
+const provider_1 = require("../types/provider");
+const provenance_1 = require("../screen/provenance");
 /** Ported cap: the Tavily API hard-rejects queries over 400 chars. */
 exports.SEARCH_QUERY_MAX_CHARS = 400;
 function capSearchQuery(query) {
@@ -71,14 +84,24 @@ function searchInjectionBlock(results, retrievedAt) {
         lines.join("\n"));
 }
 const URL_PATTERN = /https?:\/\/[^\s"'<>)\]\\]+/g;
+/** URLs referenced in a text, deduped and with trailing punctuation stripped
+ * (same normalization as the probe suite). */
+function citationUrls(outputText) {
+    const raw = outputText.match(URL_PATTERN) ?? [];
+    return [...new Set(raw.map((u) => u.replace(/[.,;:]+$/, "")))];
+}
 /** Extract URLs cited in the model's output and normalize to url_citation
- * annotations, enriching with titles from the injected sources. Deduped,
- * trailing punctuation stripped (same normalization as the probe suite). */
+ * annotations, enriching with titles from the injected sources.
+ *
+ * Screening S5 (SC-0 B3, INJ-6): ALLOWLISTED — only URLs that appear in the
+ * injected `sources` survive; a URL the model emitted that was not among the
+ * grounded sources is dropped (counted by `countDroppedCitations`). A model can
+ * no longer smuggle an attacker-controlled link into the caller's citation set. */
 function extractCitations(outputText, sources) {
-    const raw = outputText.match(URL_PATTERN) ?? [];
-    const urls = [...new Set(raw.map((u) => u.replace(/[.,;:]+$/, "")))];
     const titleByUrl = new Map(sources.map((s) => [s.url, s.title]));
-    return urls.map((url) => {
+    return citationUrls(outputText)
+        .filter((url) => titleByUrl.has(url))
+        .map((url) => {
         const title = titleByUrl.get(url);
         return {
             type: "url_citation",
@@ -87,3 +110,87 @@ function extractCitations(outputText, sources) {
         };
     });
 }
+/** Count of model-output URLs dropped by the S5 allowlist (not in the injected
+ * sources) — rides the attempt envelope as `meta.grounding.citations_dropped`. */
+function countDroppedCitations(outputText, sources) {
+    const allowed = new Set(sources.map((s) => s.url));
+    return citationUrls(outputText).filter((url) => !allowed.has(url)).length;
+}
+/** The grounding slice of the attempt meta: allowlisted citations plus the
+ * dropped-count (S5). Built once per successful grounded attempt so `run.ts`
+ * stays at its LOC ceiling (spec §10(i) — the seam lives here, not in run.ts). */
+function groundingMeta(outputText, sources) {
+    return {
+        citations: extractCitations(outputText, sources),
+        grounding: { citations_dropped: countDroppedCitations(outputText, sources) },
+    };
+}
+/** Per-result snippet cap for the spotlighted search block (S1) — bounds the
+ * untrusted payload a single result can inject. */
+exports.SEARCH_SNIPPET_MAX_CHARS = 500;
+function capSnippet(snippet) {
+    return snippet.length <= exports.SEARCH_SNIPPET_MAX_CHARS ? snippet : snippet.slice(0, exports.SEARCH_SNIPPET_MAX_CHARS);
+}
+/** Screening S1 (SC-0 B3): the SYSTEM-slot append for grounding.
+ * `legacy` (default) = the byte-identical pre-B3 injection block; `spotlight` =
+ * nothing (the results move to the user slot via `untrustedUserBlock`, and the
+ * untrusted-input policy sentence is owned by the provenance assembler and added
+ * to the system slot via `untrustedSystemAppend` — screening F2, single owner). */
+function groundingSystemAppend(assembly, results, retrievedAt) {
+    if (assembly === "spotlight")
+        return "";
+    return searchInjectionBlock(results, retrievedAt); // legacy default — byte-identical
+}
+/** Screening S1 + S2 (SC-0 B3): the untrusted segments a route+input contribute
+ * — (a) each `x-trust: untrusted` variable (S2) and (b), when
+ * `grounding.assembly: spotlight`, the search results (S1). Shared by the system-
+ * and user-slot builders so the two slots agree on "is anything untrusted
+ * present" (screening F2). Empty ⇒ nothing untrusted (byte-identical default). */
+function collectUntrustedSegments(route, input, injectedSources) {
+    const segments = [];
+    // S2: each variable annotated `x-trust: untrusted` moves out of the system slot.
+    for (const [name, trust] of Object.entries(route.variableTrust ?? {})) {
+        if (trust !== "untrusted")
+            continue;
+        const value = input[name];
+        if (value === undefined)
+            continue;
+        const text = typeof value === "string" ? value : JSON.stringify(value);
+        segments.push({ source: "variable", tier: "untrusted", text });
+    }
+    // S1: spotlight routes search results through the assembler as `search` data.
+    if (route.groundingAssembly === "spotlight" && injectedSources !== null && injectedSources.length > 0) {
+        const payload = {
+            source: "web_search",
+            retrieved_at: new Date().toISOString(),
+            results: injectedSources.map((r) => ({ title: r.title, url: r.url, snippet: capSnippet(r.snippet) })),
+        };
+        segments.push({ source: "search", tier: "untrusted", text: JSON.stringify(payload) });
+    }
+    return segments;
+}
+/** Screening S1 + S2 (SC-0 B3): the USER-slot untrusted block appended after the
+ * user directive. Assembles the untrusted segments into a single spotlighted,
+ * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
+ * when there is nothing untrusted (byte-identical default). */
+function untrustedUserBlock(route, input, injectedSources, provider) {
+    const segments = collectUntrustedSegments(route, input, injectedSources);
+    if (segments.length === 0)
+        return "";
+    const assembled = (0, provenance_1.assemblePrompt)(segments, { nonce: (0, node_crypto_1.randomUUID)(), untrustedBlock: (0, provider_1.untrustedBlockFor)(provider) });
+    return `\n\n${assembled.user}`;
+}
+/** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
+ * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
+ * surfaces its system-slot output whenever ANY untrusted segment is delivered —
+ * so an `x-trust: untrusted` variable that is NOT referenced in the system
+ * template still gets its "this is data" framing. Returns "" when there is
+ * nothing untrusted (byte-identical default). The assembler's system slot does
+ * not depend on the nonce or the block shape, so fixed placeholders suffice. */
+function untrustedSystemAppend(route, input, injectedSources) {
+    const segments = collectUntrustedSegments(route, input, injectedSources);
+    if (segments.length === 0)
+        return "";
+    const { system } = (0, provenance_1.assemblePrompt)(segments, { nonce: "", untrustedBlock: "user_json" });
+    return system === "" ? "" : `\n\n${system}`;
+}

package/dist/run/raw.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw.d.ts","sourceRoot":"","sources":["../../src/run/raw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAuBH,OAAO,EAAiC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EAGZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAW,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAA+B,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;sCAGsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;iFAK6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;6EAGyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;0BAOsB;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;iDAO6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IACjD;;;;mFAI+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;qFAIiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;sEAQkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;CACzC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;+EAE2E;IAC3E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;sEAEkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAiDhE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,GAAG,cAAc,CAsC3F;AAyPD;wDACwD;AACxD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAYrF;AAcD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,eAAe,CAiDlF"}
+{"version":3,"file":"raw.d.ts","sourceRoot":"","sources":["../../src/run/raw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAwBH,OAAO,EAAiC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EACV,cAAc,EAGd,YAAY,EAGZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAW,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAA+B,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;sCAGsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iFAC6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;iFAK6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;6EAGyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;0BAOsB;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;iDAO6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IACjD;;;;mFAI+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;qFAIiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;sEAQkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;CACzC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;+EAE2E;IAC3E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;sEAEkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACxC;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAiDhE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,GAAG,cAAc,CAsC3F;AAgQD;wDACwD;AACxD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAYrF;AAcD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,eAAe,CAiDlF"}

package/dist/run/raw.js

@@ -281,8 +281,9 @@ function recordRawRow(telemetry, p) {
  * step is ever recorded; the dispatch is byte-identical to pre-G1.
  */
 function prepareRawStep(deps, input) {
-    (0, manifest_1.warnMissingRequiredDimensions)(deps.manifest ?? null, input.tags ?? {});
     const runCtx = (0, run_context_1.getActiveRunContext)();
+    // Warn on the EFFECTIVE tags: an auto-stamped run_id (RC-1) is not missing.
+    (0, manifest_1.warnMissingRequiredDimensions)(deps.manifest ?? null, (0, run_context_1.withRunIdTag)(input.tags ?? {}, runCtx));
     if (runCtx === null)
         return null;
     const rawModelId = `${input.provider}/${input.model}`;
@@ -308,8 +309,14 @@ function finalizeRaw(deps, input, result, latencyMs, step) {
     const callId = (0, node_crypto_1.randomUUID)();
     // CE-2 F2: the declared tier is reported truthfully on the row AND the meta.
     const requestedTier = input.serviceTier ?? "standard";
-    // lane is SDK-owned and cannot be overridden by a caller-supplied tag.
-    const tags = { ...(input.tags ?? {}), lane: "raw" };
+    // RC-1: `run_id` from the ambient run (caller's value wins); lane is SDK-owned
+    // and cannot be overridden by a caller-supplied tag.
+    // GS-1: `tags.step` from the ambient step key (step.stepKey = caller's stepKey
+    // ?? tags.step ?? the auto provider/model#n key) when a run is active and the
+    // caller set none — spread FIRST so a caller value wins, and omitted entirely
+    // outside a run context so the row stays byte-identical (parity with RC-1).
+    const stepTag = step !== null ? { step: step.stepKey } : {};
+    const tags = { ...stepTag, ...(0, run_context_1.withRunIdTag)(input.tags ?? {}, step?.runCtx ?? null), lane: "raw" };
     // WI-1 (spec §2, §6.3 lane parity): the attempt envelope, built by the SAME
     // producer + rendered-request canonicalization the routed lane uses. The raw
     // lane never sends an output schema (unvalidated by design), so schema = null.

package/dist/run/record-attempt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAmHlG"}
+{"version":3,"file":"record-attempt.d.ts","sourceRoot":"","sources":["../../src/run/record-attempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAgB,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;gDAG4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;qFAEiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC;;;wEAGoE;IACpE,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,aAAa,CAUf;AAED;;yCAEyC;AACzC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CA8HlG"}

package/dist/run/record-attempt.js

@@ -109,6 +109,14 @@ function createRecordAttempt(deps) {
                 ...(attempt.tokensCacheWrite1h !== undefined ? { tokensCacheWrite1h: attempt.tokensCacheWrite1h } : {}),
             },
         });
+        // GS-1: auto-stamp `tags.step` from the ambient step key — the run graph's
+        // step, made a groupable tag — when a run is active and the caller set none.
+        // Mirrors withRunIdTag exactly: a caller value wins (effectiveTags carries it,
+        // and it is spread after this base), and OUTSIDE a run context nothing is added
+        // so the row stays byte-identical. `autoStepKey` already resolves the caller's
+        // stepKey ?? tags.step ?? the auto `route#n` key, so a caller's own step lands
+        // unchanged and the tag agrees with the ground-truth step row.
+        const stepTag = runCtx !== null && autoStepKey !== null ? { step: autoStepKey } : {};
         const row = {
             id: (0, node_crypto_1.randomUUID)(),
             ts: new Date().toISOString(),
@@ -133,7 +141,7 @@ function createRecordAttempt(deps) {
             attemptsJson: JSON.stringify(ledger.snapshot()),
             // `rung` is stamped LAST so a caller's extraTags (Q1 quality tags) can
             // never override the recorder-owned rung.
-            tagsJson: JSON.stringify({ ...effectiveTags, ...attempt.extraTags, rung }),
+            tagsJson: JSON.stringify({ ...stepTag, ...effectiveTags, ...attempt.extraTags, rung }),
             fingerprintCell: route.fingerprintCell,
             servedVariant,
             repairedBy: attempt.repairedBy ?? null,
@@ -142,6 +150,9 @@ function createRecordAttempt(deps) {
             attemptSeq: ladderKey.attemptSeq,
             candidateIndex: ladderKey.candidateIndex,
             meta,
+            // CS-1 (spec §6): the counts-only mask receipt for this attempt, or absent
+            // when the route does not mask. NEVER a matched value.
+            ...(attempt.mask !== undefined ? { mask: attempt.mask } : {}),
         };
         telemetry.record(row);
         // Mirror this inference into a ground-truth step attempt (fail-open — the

package/dist/run/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAS3D,OAAO,KAAK,EAAE,cAAc,EAAoC,MAAM,aAAa,CAAC;AAWpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;gDAE4C;IAC5C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC;;0BAEsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;mFAG+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;uDAKmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD;;;;2EAIuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAsBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAqkBhG"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAS3D,OAAO,KAAK,EAAE,cAAc,EAAoC,MAAM,aAAa,CAAC;AAUpF,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;gDAE4C;IAC5C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC;;0BAEsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;mFAG+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;uDAKmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD;;;;2EAIuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAsBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAwkBhG"}

package/dist/run/run.js

@@ -24,6 +24,7 @@ const repair_1 = require("./repair");
 const grounding_1 = require("./grounding");
 const validate_1 = require("./validate");
 const dispatch_1 = require("./dispatch");
+const vault_1 = require("../mask/vault");
 const record_attempt_1 = require("./record-attempt");
 const ladder_key_1 = require("./ladder-key");
 const quality_gate_1 = require("./quality-gate");
@@ -52,9 +53,13 @@ async function run(deps, routeName, opts) {
     const variant = (0, variant_1.resolveVariant)(baseRoute, opts.variant, mode);
     const servedVariant = variant?.name ?? null;
     const route = (0, resolve_1.applyRunRequirements)((0, variant_1.effectiveRoute)(baseRoute, variant), opts.zeroRetention === true);
-    const effectiveTags = route.require.includes("zero_retention") ? { ...opts.tags, zdr_enforced: "true" } : opts.tags;
+    // RC-1: inside a run context the SDK stamps `run_id` (episodeKey, else run id)
+    // when the caller passed none — the bridge between tags and the run graph.
+    const runCtx = (0, run_context_1.getActiveRunContext)();
+    const runTags = (0, run_context_1.withRunIdTag)(opts.tags, runCtx);
+    const effectiveTags = route.require.includes("zero_retention") ? { ...runTags, zdr_enforced: "true" } : runTags;
     // Data-hygiene warning (spec WS5): once per process per dimension.
-    (0, manifest_1.warnMissingRequiredDimensions)(deps.manifest ?? null, opts.tags);
+    (0, manifest_1.warnMissingRequiredDimensions)(deps.manifest ?? null, effectiveTags);
     const ledger = (0, retry_1.createRetryLedger)(route.policy);
     const sleep = deps.sleep ?? DEFAULT_SLEEP;
     const guard = opts.budget
@@ -70,7 +75,6 @@ async function run(deps, routeName, opts) {
     // Auto-step (E2 chunk A, spec §1.4): with an active run context, each attempt
     // exit that records an inference also records a ground-truth step referencing
     // it (attempt-per-row, ruling c). Inert without a run.start on this path.
-    const runCtx = (0, run_context_1.getActiveRunContext)();
     const autoStepKey = runCtx !== null ? (0, run_context_1.resolveStepKey)(opts.stepKey, opts.tags.step, () => runCtx.nextStepKey(route.route)) : null;
     // Per-call ladder key (spec §2.1 R0): one call_id, a monotonic attempt_seq per
     // row, and the current candidate_index (advanced by nextCandidate below).
@@ -233,7 +237,7 @@ async function run(deps, routeName, opts) {
                     repairedBy,
                     callId: ladder.callId,
                     ...(injectedSources !== null
-                        ? { citations: (0, grounding_1.extractCitations)(result.text, injectedSources) }
+                        ? (0, grounding_1.groundingMeta)(result.text, injectedSources)
                         : {}),
                 },
             },
@@ -258,6 +262,7 @@ async function run(deps, routeName, opts) {
     // retries; cost accrues to the envelope and its own telemetry row.
     let searchResponse = null;
     let injectedSources = null;
+    const maskCtx = route.mask !== undefined ? { policy: route.mask, vault: (0, vault_1.createRunVault)() } : null; // CS-1: run-scoped vault; null ⇒ byte-identical
     while (candidate !== null) {
         // Runtime layer of the candidate-set invariant: even a compromised
         // iterator cannot reach an adapter with a pair outside the declared list.
@@ -286,7 +291,7 @@ async function run(deps, routeName, opts) {
         const flags = deps.capabilities(candidate.provider, candidate.model);
         let systemPrompt = (0, template_1.renderTemplate)(route.systemTemplate, {
             variables: opts.input,
-            capabilities: flags,
+            capabilities: flags, variableTrust: route.variableTrust,
         });
         // Variant augmentation (WS1): appended after capability-conditionals,
         // before json coaching — promptAppend first, then the reasoning scaffold.
@@ -337,7 +342,7 @@ async function run(deps, routeName, opts) {
                     continue;
                 }
             }
-            systemPrompt += (0, grounding_1.searchInjectionBlock)(searchResponse.results, new Date().toISOString());
+            systemPrompt += (0, grounding_1.groundingSystemAppend)(route.groundingAssembly, searchResponse.results, new Date().toISOString());
             injectedSources = searchResponse.results;
         }
         // json_mode rung (route-level) or a candidate without native strict
@@ -359,21 +364,19 @@ async function run(deps, routeName, opts) {
         // CE-1 (spec §2.2, run/cache-handle.ts): `suppressed` drops the customer handle after a cache_invalid.
         const candidateKey = `${candidate.provider} ${candidate.model}`;
         const suppressed = droppedCacheHandle.has(candidateKey);
-        // buildAdapterRequest carries the grounding hint + unified tools passthrough
-        // (spec §4.4); dispatchCandidate streams deltas when a sink is wired, else
-        // buffers via call() — the returned result is identical either way.
-        const request = (0, dispatch_1.buildAdapterRequest)({
+        // Build + mask (spec §1.2 — user slot only) + dispatch as one seam; null mask ⇒ byte-identical.
+        const dispatched = await (0, dispatch_1.buildDispatchMaybeMasked)(adapter, {
             route,
             candidate,
-            systemPrompt,
-            userDirective: USER_DIRECTIVE,
+            systemPrompt: systemPrompt + (0, grounding_1.untrustedSystemAppend)(route, opts.input, injectedSources),
+            userDirective: USER_DIRECTIVE + (0, grounding_1.untrustedUserBlock)(route, opts.input, injectedSources, candidate.provider),
             nativeGrounded,
             opts,
             suppressCustomerCache: suppressed,
-        });
-        const started = Date.now();
-        const result = await (0, dispatch_1.dispatchCandidate)(adapter, request, deps.onStreamDelta);
-        const latencyMs = Date.now() - started;
+        }, deps.onStreamDelta, maskCtx);
+        if (!dispatched.result.ok && dispatched.maskRefusal !== undefined)
+            failRun(candidate, dispatched.result.failure, 0);
+        const { result, latencyMs, seam: maskSeam } = dispatched;
         if (result.ok) {
             const { costUsd, envelopeChargeUsd, pricingMissing } = (0, cost_1.attemptCost)(candidate.provider, candidate.model, result.usage, unpricedRatePerTok);
             guard?.settle(envelopeChargeUsd);
@@ -421,15 +424,18 @@ async function run(deps, routeName, opts) {
                     continue;
                 }
                 const acceptTags = gate !== null ? (0, quality_gate_1.qualityTags)(gate) : undefined;
-                const inferenceId = recordAttempt((0, accept_1.successAttemptRow)(candidate, result.usage, costUsd, latencyMs, pricingMissing, null, metaInputs, acceptTags));
+                const output = maskSeam !== null ? maskSeam.rehydrateOutput(outcome.parsed) : outcome.parsed; // rehydrate post-validate (spec §5)
+                const maskReceipt = maskSeam?.receipt(); // read AFTER rehydrate so counts are final
+                const inferenceId = recordAttempt({ ...(0, accept_1.successAttemptRow)(candidate, result.usage, costUsd, latencyMs, pricingMissing, null, metaInputs, acceptTags), ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}) });
                 captureAttempt(inferenceId, result.text);
                 const meta = (0, accept_1.buildSuccessMeta)({
                     inferenceId, route, candidate, usage: result.usage, costUsd, latencyMs,
                     attemptsByClass: ledger.snapshot(), servedVariant, callId: ladder.callId,
-                    ...(injectedSources !== null ? { citations: (0, grounding_1.extractCitations)(result.text, injectedSources) } : {}),
+                    ...(injectedSources !== null ? (0, grounding_1.groundingMeta)(result.text, injectedSources) : {}),
                     ...(gate !== null ? { quality: { score: gate.score, verdict: "pass", judgedBy: null } } : {}),
+                    ...(maskReceipt !== undefined ? { mask: maskReceipt } : {}),
                 });
-                return { output: outcome.parsed, meta };
+                return { output, meta };
             }
             // Schema-invalid output — a real (billed) attempt that failed.
             const failure = {

package/dist/screen/provenance.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Screening — content provenance / assembly (WIRED 2026-08-23, screening B3).
+ * Spec §2. The load-bearing DETERMINISTIC control: every segment the SDK
+ * assembles carries {source, tier}, and the ASSEMBLER — not a detector —
+ * decides where each tier may appear. The structural invariant it enforces is
+ * "untrusted content never occupies the system slot"; trusted (`template`) and
+ * semi (`variable` by default) render into the system slot as today, so a route
+ * with no `x-trust` annotation and `grounding.assembly: legacy` is byte-identical.
+ *
+ * This is the SC-0 seam that must land before CS-1 Chunk A (masking wraps the
+ * same assembled request). It replaces, behind the `grounding.assembly:
+ * spotlight` knob and the `x-trust: untrusted` opt-in, the ad-hoc
+ * `systemPrompt += …` concatenations audited as INJ-1 (src/run/run.ts:475),
+ * INJ-3 (src/routes/template.ts:92-103 → src/run/run.ts:420-431) and INJ-2
+ * (packages/modelrig-server raw-completions.ts:60-76).
+ */
+import type { ContentSource, TrustTier } from "../detect/detector";
+/** One assembled segment with its provenance. The assembler groups by tier so a
+ * receipt can attribute a finding to a source without holding the text
+ * downstream (the ledger here is ephemeral, used only at assembly time). */
+export interface ContentSegment {
+    readonly source: ContentSource;
+    readonly tier: TrustTier;
+    readonly text: string;
+}
+/** The two provider slots after assembly. Untrusted segments are spotlighted
+ * into the user slot (JSON-encoded block, randomized delimiter) or, for an
+ * adapter that reports `untrusted_block: tool_result`, framed as a synthetic
+ * tool_result envelope (Anthropic guidance, research §2.3). */
+export interface AssembledPrompt {
+    readonly system: string;
+    readonly user: string;
+    readonly segments: readonly ContentSegment[];
+}
+/** The policy sentence placed in the SYSTEM slot whenever an untrusted block is
+ * spotlighted into the user slot (spec §2.2). Verbatim — the docs page and the
+ * assembler share this constant. Not outward marketing copy (claim-lint §7 does
+ * not apply); it is prompt scaffolding delivered to the model. */
+export declare const UNTRUSTED_POLICY_SENTENCE: string;
+/**
+ * Default trust tier for a source (spec §2.1). A route's `screen.sources` /
+ * `x-trust` may TIGHTEN (never loosen) these.
+ */
+export declare function defaultTier(source: ContentSource): TrustTier;
+/** Strip Unicode tag characters (U+E0000–U+E007F) — the invisible plane abused
+ * to smuggle instructions past a human reviewer — from untrusted text before it
+ * is spotlighted (spec §2.2). */
+export declare function stripUnicodeTags(text: string): string;
+/**
+ * Assemble segments into the two slots, enforcing "untrusted never in system"
+ * and spotlighting untrusted content per the adapter's `untrusted_block`
+ * capability. Randomized delimiter per run; JSON-encode untrusted blocks; strip
+ * Unicode tag chars. Pure over the segment list + a per-run nonce.
+ */
+export declare function assemblePrompt(segments: readonly ContentSegment[], opts: {
+    readonly nonce: string;
+    readonly untrustedBlock: "tool_result" | "user_json";
+}): AssembledPrompt;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/screen/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/screen/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;4EAE4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;+DAG+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C;AAED;;;kEAGkE;AAClE,eAAO,MAAM,yBAAyB,QAEkC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAmB5D;AAED;;iCAEiC;AACjC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAiBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GACrF,eAAe,CA8BjB"}